Logo ExamsQA
Exit
Official Bank 0/205

Splunk Enterprise Certified Architect Exam (SPLK-2002) - Splunk Exam Questions

Last updated on June 20, 2026

97% Exam Compliance
205 Total Questions
1
Question
(What is the best way to configure and manage receiving ports for clustered indexers?)
Options
A Use Splunk Web to create the receiving port on each peer node.
B Run the splunk enable listen command on each peer node.
C Define the receiving port in /etc/manager-apps/_cluster/local/inputs.conf and push it to the peer nodes.
D Define the receiving port in /etc/deployment-apps/cluster-app/local/inputs.conf and deploy it to the peer nodes.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
Which of the following should be included in a deployment plan?
Select 3
Options
A Business continuity and disaster recovery plans.
B Current and future topology diagrams of the IT environment.
C A comprehensive list of stakeholders, either direct or indirect.
D Current logging details and data source inventory.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?
Options
A Configure syslog to send the data to multiple Splunk indexers.
B Use a Splunk forwarder to collect the input on port 514 and forward the data.
C Configure syslog to write logs and use a Splunk forwarder to collect the logs.
D Use a Splunk indexer to collect a network input on port 514 directly.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
(Which command is used to initially add a search head to a single-site indexer cluster?)
Options
A splunk add cluster-manager -manager_uri https://10.0.0.1:8089 -secret changeme
B splunk edit cluster-config -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme
C splunk add cluster-manager -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme
D splunk edit cluster-config -mode peer -manager_uri https://10.0.0.1:8089 -secret changeme
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
A customer currently has many deployment clients being managed by a single, dedicated deployment server. The customer plans to double the number of clients.

What could be done to minimize performance issues?
Options
A Modify deploymentclient. conf to change from a Pull to Push mechanism.
B Increase the current deployment client phone home interval.
C Decrease the current deployment client phone home interval.
D Reduce the number of apps in the Manager Node repository.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.